The point that policy gates evaluate resulting state rather than the agent's explanation is the strongest one here. One suggestion on the plan-artifact step: have the gate diff the plan against what actually executes (e.g. the declared resources vs. the real terraform plan JSON) and fail on drift, otherwise the artifact becomes documentation instead of a contract. For the bastion-style case, a policy annotation like 'incident-response, do not remove' that blocks deletion seems more durable than any observation-window heuristic, which can't see rare-use rules. Is the policy directory versioned separately with its own CODEOWNERS?